name: Build and publish static assets

on:
  push:
    branches: [main]
    tags: ["v*"]

permissions:
  contents: write

jobs:
  publish:
    runs-on: large
    if: ${{ !startsWith(github.ref, 'refs/heads/') || !contains(github.event.head_commit.message, '[auto-version-bump]') }}
    steps:
      - name: Check out repository
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}
          persist-credentials: true

      - name: Check source and release metadata
        shell: bash
        run: |
          set -euo pipefail
          python3 scripts/bump-version.py --check
          scripts/check-static.sh

      - name: Fetch and verify pinned static assets
        shell: bash
        run: |
          set -euo pipefail
          npm install --no-audit --no-fund
          npm run build:assets
          test -s public/static/piper-wasm-v1/piper/piper_phonemize.wasm
          test -s public/static/piper-wasm-v1/piper/piper_phonemize.data
          test -s public/static/piper-wasm-v1/onnx/ort-wasm-simd-threaded.mjs
          test -s public/static/piper-wasm-v1/onnx/ort-wasm-simd-threaded.wasm
          test -s public/static/piper-wasm-v1/voices/sv/sv_SE/alma/medium/sv_SE-alma-medium.onnx
          test -s public/static/piper-wasm-v1/voices/sv/sv_SE/lisa/medium/sv_SE-lisa-medium.onnx
          test -s public/static/piper-wasm-v1/voices/sv/sv_SE/nst/medium/sv_SE-nst-medium.onnx
          test -s public/static/piper-wasm-v1/voices/ATTRIBUTION.txt

      - name: Ensure Helm is available
        shell: bash
        env:
          HELM_VERSION: v3.17.3
        run: |
          set -euo pipefail
          if command -v helm >/dev/null 2>&1; then helm version --short; exit 0; fi
          mkdir -p "$HOME/.local/bin" "$RUNNER_TEMP/helm"
          archive="$RUNNER_TEMP/helm/helm-${HELM_VERSION}-linux-amd64.tar.gz"
          curl -fsSLo "$archive" "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
          curl -fsSLo "$archive.sha256sum" "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz.sha256sum"
          (cd "$RUNNER_TEMP/helm" && sha256sum -c "$(basename "$archive").sha256sum")
          tar -xzf "$archive" -C "$RUNNER_TEMP/helm"
          install "$RUNNER_TEMP/helm/linux-amd64/helm" "$HOME/.local/bin/helm"
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Lint and render Helm chart
        shell: bash
        run: |
          set -euo pipefail
          helm lint deploy/helm/ai-spel-static
          helm template ai-spel-static deploy/helm/ai-spel-static --namespace ai-spel > "$RUNNER_TEMP/static-manifest.yaml"
          grep -q 'kind: Deployment' "$RUNNER_TEMP/static-manifest.yaml"
          grep -q 'kind: Service' "$RUNNER_TEMP/static-manifest.yaml"
          grep -q 'path: /static' "$RUNNER_TEMP/static-manifest.yaml"

      - name: Build and push commit image
        if: startsWith(github.ref, 'refs/heads/')
        shell: bash
        env:
          HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }}
          HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }}
        run: |
          set -euo pipefail
          test -n "$HARBOR_USERNAME" && test -n "$HARBOR_PASSWORD"
          printf '%s' "$HARBOR_PASSWORD" | docker login harbor.k3s.k0.nu --username "$HARBOR_USERNAME" --password-stdin
          unset HARBOR_PASSWORD
          version="$(cat VERSION)"
          tag="harbor.k3s.k0.nu/ai-spel/static:edge-${GITHUB_SHA:0:12}"
          docker build --platform linux/amd64 --pull --build-arg "STATIC_VERSION=$version" --tag "$tag" .
          docker image push "$tag"

      - name: Bump version and tag release commit
        id: bump
        if: startsWith(github.ref, 'refs/heads/')
        shell: bash
        run: |
          set -euo pipefail
          git fetch origin main --quiet
          test "$(git rev-parse origin/main)" = "$GITHUB_SHA"
          version="$(python3 scripts/bump-version.py)"
          git config user.name "Gitea Actions"
          git config user.email "actions@users.noreply.gitea"
          git add VERSION deploy/helm/ai-spel-static/Chart.yaml package-lock.json
          git commit -m "Release $version [auto-version-bump]"
          git tag -a "v$version" -m "v$version"
          git push origin HEAD:main "refs/tags/v$version"
          echo "version=$version" >> "$GITHUB_OUTPUT"

      - name: Publish versioned image, chart, and manifest
        if: ${{ startsWith(github.ref, 'refs/tags/') || steps.bump.outputs.version != '' }}
        shell: bash
        env:
          AUTO_RELEASE_VERSION: ${{ steps.bump.outputs.version }}
          HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }}
          HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }}
          ORAS_VERSION: 1.2.3
        run: |
          set -euo pipefail
          version="$(cat VERSION)"
          test -n "$HARBOR_USERNAME" && test -n "$HARBOR_PASSWORD"
          if [[ "$GITHUB_REF" == refs/tags/* ]]; then test "$GITHUB_REF_NAME" = "v$version"; else test "$AUTO_RELEASE_VERSION" = "$version"; fi
          python3 scripts/bump-version.py --check
          printf '%s' "$HARBOR_PASSWORD" | docker login harbor.k3s.k0.nu --username "$HARBOR_USERNAME" --password-stdin
          unset HARBOR_PASSWORD
          image="harbor.k3s.k0.nu/ai-spel/static:$version"
          docker build --platform linux/amd64 --pull --build-arg "STATIC_VERSION=$version" --tag "$image" .
          docker image push "$image"
          publish_dir="$(mktemp -d)"
          trap 'rm -rf "$publish_dir"' EXIT
          helm lint deploy/helm/ai-spel-static
          helm package deploy/helm/ai-spel-static --destination "$publish_dir" --version "$version" --app-version "$version"
          registry_config="$RUNNER_TEMP/helm/registry.json"
          mkdir -p "$(dirname "$registry_config")"
          printf '{}' > "$registry_config"
          printf '%s' "$HARBOR_PASSWORD" | helm registry login harbor.k3s.k0.nu --username "$HARBOR_USERNAME" --password-stdin --registry-config "$registry_config"
          helm push "$publish_dir/ai-spel-static-$version.tgz" oci://harbor.k3s.k0.nu/ai-spel --registry-config "$registry_config"
          chart_metadata="$(helm show chart oci://harbor.k3s.k0.nu/ai-spel/ai-spel-static --version "$version" --registry-config "$registry_config")"
          test "$(printf '%s\n' "$chart_metadata" | awk '$1 == "version:" { print $2 }')" = "$version"
          helm template ai-spel-static "$publish_dir/ai-spel-static-$version.tgz" --namespace ai-spel > "$publish_dir/static-manifest.yaml"
          mkdir -p "$RUNNER_TEMP/oras"
          archive="$RUNNER_TEMP/oras/oras_${ORAS_VERSION}_linux_amd64.tar.gz"
          curl -fsSLo "$archive" "https://github.com/oras-project/oras/releases/download/v${ORAS_VERSION}/oras_${ORAS_VERSION}_linux_amd64.tar.gz"
          echo 'b4efc97a91f471f323f193ea4b4d63d8ff443ca3aab514151a30751330852827  '"$archive" | sha256sum -c -
          tar -xzf "$archive" -C "$RUNNER_TEMP/oras" oras
          printf '%s' "$HARBOR_PASSWORD" | "$RUNNER_TEMP/oras/oras" login harbor.k3s.k0.nu --username "$HARBOR_USERNAME" --password-stdin
          unset HARBOR_PASSWORD
          (cd "$publish_dir" && "$RUNNER_TEMP/oras/oras" push --artifact-type application/vnd.ai-spel.static-manifest.v1 "harbor.k3s.k0.nu/ai-spel/static-manifest:$version" "static-manifest.yaml:application/yaml")

          ready=false
          for attempt in $(seq 1 120); do
            deployed="$(curl -fsS https://ai-spel.k3s.k0.nu/static/version.txt 2>/dev/null || true)"
            if [[ "$deployed" == "$version" ]]; then ready=true; break; fi
            sleep 5
          done
          [[ "$ready" == true ]] || { echo "Static service did not report version $version"; exit 1; }
          for path in \
            /static/piper-wasm-v1/onnx/ort-wasm-simd-threaded.mjs \
            /static/piper-wasm-v1/onnx/ort-wasm-simd-threaded.wasm \
            /static/piper-wasm-v1/piper/piper_phonemize.data \
            /static/piper-wasm-v1/voices/sv/sv_SE/nst/medium/sv_SE-nst-medium.onnx; do
            curl -fsSI "https://ai-spel.k3s.k0.nu$path" >/dev/null
          done